enable ForbiddenAttributesProtection in query.rb
add changelog entry for #3336
Merge branch 'dev' into fix/ma_query_controller

Conflicts:
	doc/CHANGELOG.md
sort methods of PermittedParams class
use permitted params in QueryControllier
prepare_query need to be called AFTER update_attributes to ensure invariants
less duplicated code in queries logic
Merge branch 'dev' into fix/ma_query_controller

Conflicts:
	app/models/permitted_params.rb
we have to set @query.project before adding filters, so that we can determine which filters the user may set
Fixes changelog entry order
Merge pull request #753 from opf/fix/ma_query_controller